<html>
<head>

<title>Administering roles and permissions</title>

</head>
<body>
<span class="Header">Administering roles and permissions</span>
<p>
<span class="PlainText"><b>Help for domain administration: Index</b>
<p>
<ul>
	<dl>
	<dt><a href="DomAdminOverview.html">Domain administration overview</a>
		<dd><a href="DomAdminAddUsers.html">Adding and editing user accounts</a>
		<dd><b>You are here: Administering roles and permissions
			<ul>
			<li><a href="#aboutroles">Understanding roles and permissions
			</a><li><a href="#aboutroles"></a><a href="#userroles">Editing user role assignments</a>
			<li><a href="#editroles">Editing roles</a>
			<li><a href="#addroles">Adding roles</a>
			<li><a href="#viewaddresources">About resources and actions</a>
			</ul></b>
		<dd><a href="DomAdminUserGroups.html">Creating and editing user groups</a>
		<dd><a href="DomAdminProjectGroups.html">Creating and editing project groups</a>
		<dd><a href="DomAdminProjectApproval.html">Approving, disapproving, or deferring projects</a>
		<dd><a href="DomAdminAuditLogs.html">Using domain administration tools</a>
    <dt><a href="/servlets/HelpTOC">Back to main Help index</a>
	</dl>
</ul>
<p>


<hr noshade size=1>
<a name="aboutroles"></a><span class="InputHeader">Understanding roles and permissions</span>
<p>
Every user on this site is able to access features and conduct activities based upon roles the user has been granted. There are two kinds of roles:
<ul>
<li><b><i>Domain roles</i></b> give users access to generalized information and actions throughout the site. Domain Administrators assign and configure domain roles to all users on this site. Every new user automatically gets the "registered user" domain role by virtue of being registered on your domain. It is also possible to create other domain roles; more about this is covered in the <a href="#addroles">Adding roles</a> section of this document.
<p>
<li><b><i>Project roles</i></b> are limited to information and actions within a project. Domain Administrators also can configure project roles, but by design Project Owners usually assign project roles to users when they become project members.
</ul>
<p>
Roles are either assigned to users through membership in a project, or through association with project groups or user groups. All roles have a default set of permissions associated with them. These permissions govern the users' ability to conduct certain actions on this site. 
<p>
As Domain Administrator, you can:
<ul>
<li>Use and assigning existing roles "as is."
<p>
<li>Alter existing roles by changing the permissions, actions, and/or resources are associated with them.
<p>
<li>Create entirely new roles and designate permissions for them. (You cannot, however, create new permissions.) See <a href="#addroles">Adding roles</a>.
</ul>
<p>
You can also tailor roles and permissions for sets of users by creating user groups, and for sets of projects by making project groups. For more information about this, see <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a>.
<p>

<hr noshade size=1>
<a name="userroles"></a><span class="InputHeader">Editing user role assignments</span>
<p>
The fields and options in the bottom section of the <b>Edit User</b> page enable you to view and change the individual user's role assignments.
<p>
<dt><b><i>Group Memberships</i></b>
	<dd>The user's affiliation with any user group or project categories in this domain are listed here. User groups and project groups are created and configured by you as the Domain Administrator. See <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a> for more information.
<p>
<dt><b><i>Domain-wide Roles</i></b>
	<dd>Domain roles assigned or conferred to the user are listed here. These are generalized roles that permit the user to view site pages and conduct site actions not associated with specific projects. See previous  <a href="#aboutroles">Understanding roles and permissions</a> section. 
<p>
<dt>
<b><i>Roles in domain's public projects</i></b>
	<dd>Every public project hosted on this domain is automatically part of the default project group labeled (not surprisingly) "All public projects." Any roles the user holds in such projects are flagged here. See <a href="DomAdminProjectGroups.html">Creating and editing project groups</a> for more information.
	<p>
<dt><b><i>Submit Changes</i></b>
	<dd>This button submits any modifications to the individual user account made in the fields above. Modifications to the user's roles are separate actions.
	<p>
<dt><b><i>Project Roles</i></b>
	<dd>Roles the user holds that are associated with specific projects are listed here, grouped by project name. Project names link to project home pages. This list includes both open source and private, proprietary projects. See <a href="#aboutroles">Understanding roles and permission</a> section for a more comprehensive discussion of roles.
<p>
<dt><b><i>Detailed Role Info</i></b>
	<dd>These links lead to secondary screens with more detailed role information associated with the current user:
	<p>
		<ul>
		<li><i>Direct and derived roles</i> displays two different sets roles held by the user. <i>Direct roles</i> are those roles expressly assigned to the user. For example, the user requested and was approved for a certain role in a project. <i>Derived roles</i> are roles <i>conferred</i> to this user because she/he is a member of a project specifically associated with a project group's set of roles, or belongs to a user group assigned a unique set of roles.
		<p>
		<li><i>Details of permissions</i> displays a screen rather unceremoniously entitled <b>Permission Dump</b> because it tabulates literally every single permission the user holds in your domain.
		</ul>
		<p>
	<dd>Note that when individual users are part of particular project groups or user groups, you can assign attributes and modify multiple user accounts associated with those groups by using the <b>Project Group Edit</b> or <b>User Group Edit</b> screens. See <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a> for more information.
<p>

<dt><b>Other operations: <i>Delete User</i></b>
	<dd>This link removes the current user account. A confirmation message prompts you for verification before this action is completed.

<p>


<hr noshade size=1>
<a name="editroles"></a><span class="InputHeader">Editing roles</span>
<p>
This site features a set of default roles that you may view using the <i>Administer Roles</i> link in the "Admin Options" of your <b>Start Page</b>. This displays the <b>Role List</b> page with all site roles listed as either domain or project-level. A brief description of each role is included.
<p>
To view a list of individual permissions associated with this role, click on the role name link in the <b>Role List</b> page. Each permission listed on the <b>Editing Role</b> page is characterized by both the site resource and site action that it enables, i.e. "Project - Suggest" or "Version Control - Update." The far right "Resource(s)" column defines in which site resources each permission is effective. The default is for each permission to apply to all available resources.
<p>
As domain administrator, you have the option to modify this site's pre-packaged roles by changing the permissions associated with them as needed. Placing a check mark in the boxes next to a permission <i>removes this permission</i> from the role.
<p>
If you wish to <i>add</i> permissions to a role, click the <i>Add New Permission</i> link at the top of the <b>Editing Role</b> page. This screen gives you a list of all available permissions. To add permissions, place check marks in the appropriate boxes.
<p>
In addition to editing roles by adding and removing permissions, you can modify or limit which resources the permissions associated with that role will apply to. The resource section at the bottom of the <b>Add Permission to Role</b> page lets you determine in which site resources to allocate the role's new permissions.
<p>
<ul>
<li>Selecting "All available resources .*" applies the selected permissions for this role universally to all site resources available to this role, including both web content and source code.
<p>
<li>Choosing "All web pages /www/.*" limits the selected permission for this role specifically to web pages. This means the scope of these permissions does not pertain to any source code level access, but only to web page content. For example, assigning the "Version Control - Commit" permission to a role and designating "All web pages /www/.*" as the resource results in users with this role only being able to check out and commit web page content, not project source code.
</ul>
After you have selected the permissions to add and determined the site resources to apply these to, click the <b><i>Add Permissions</i></b> button at the bottom of the page.
<p>
See the section on <a href="#viewaddresources">Viewing and adding resources</a> for more information about site resources. 
<p>

<hr noshade size=1>
<a name="addroles"></a><span class="InputHeader">Adding roles</span>
<p>
If your site has special requirements that none of the default roles meet, you can also create custom roles and assign the appropriate permissions to them. To do this, in the <b>Role List</b> page click the "Add New Role" link in either the domain or project section, depending upon the type of role you want to create. Depending upon which one you click, this displays either the <b>Add Domain Role</b> or <b>Add Project Role</b> page. You can switch between these pages using the links at the top of this page.
<p>
You must determine what you want the scope of your newly created role to be. If you want to create a role that enables certain user actions universally across the site, add the new role as a domain role. If you want to create a role with permissions that are <i>not</i> universally enabled across this site, you should add the new role as a project role. When project roles are assigned, their associated permissions are granted to the user only within that project.
<p>
The <b>Add Domain Role</b> and <b>Add Project Role</b> pages list every permission/action available at that level. Use this feature with extreme caution! Assigning permissions to roles may have security implications.
<p>


<hr noshade size=1>
<a name="viewaddresources"></a><span class="InputHeader">About resources and actions</span>
<p>
<b><i>Resources</i></b> are all of the different elements used in this site including tools, content, projects, and web pages. User roles and permissions on this site are defined by the specific resources they apply to. For example, each of these permissions -- "Mailing List - View," "Project - Suggest," "Version Control - Commit" -- is comprised of a certain resource on this site and the <b><i>action</i></b> being permitted within that resource. In these three examples, the resources are, respectively: mailing list, project, and version control.
<p>
Resources are described on this site using regular expressions. Thus, the pattern or regular expression meaning all available resources is ".*".
<p>
You can view a complete list of all available resources on this site by clicking the <i>Resource List</i> link at the top of the <b>Editing Role</b> page. The default items in the Resource List page are "All available resources (.*)" and "All web pages (/www/.*)".  Clicking on the resource link displays the <b>Edit Resource</b> screen where there is short, identifying description and the pattern that represents the resource as a regular expression.
<p>
As the domain administrator, you can also create new resources and define them using the <i>Add New Resource</i> link at the top of the <b>Editing Role</b> page. This is a powerful and flexible administrative feature. For example, you might decide that you want to create new user roles with permissions that only apply to certain types of files. If these were java files, you could define that as a resource using the regular expression "*.java". Then you could either create new roles or modify existing roles by adding permissions defined with this "*.java" resource. Your newly created resource automatically appears in the <b>Add Permission to Role</b> page. When you grant these roles to users, their permissions are limited to java files only.
<p>

<hr noshade size=1>
<a href="DomAdminOverview.html">Back to Help for domain administration</a><br>
<a href="/servlets/HelpTOC">Back to main Help index</a>
</span>

</body>
</html>
